fix blank UAA errors
don't blow up if refresh token expires

just doesn't change the refresh token, and allows ccng requests to fail
instead

[#43577727]